Hello, I bother you again,
for this problem:

#WordPress Progress Bar plugin <= 2.2.0 – Cross Site Scripting (XSS) vulnerability
– Vulnerability type: Cross Site Scripting (XSS)
-No Update Available

We wrote to Defender Pro and this is their response to the false positive:

The report comes from “Known vulnerabilities” scan module of Defender and for this particular scan we are actually using Patchstack vulnerability database and API.
This vulnerability is listed by them:

https://patchstack.com/database/vulnerability/progress-bar/wordpress-progress-bar-plugin-2-1-6-cross-site-scripting-xss-vulnerability

and that's why Defender picks it up.
The good news is that while they mark it as “medium severity”, it's also not reported as exploited so far

We can't change Patchstack database and we can't and shouldn't really add exceptions to scan on our end so in this case if the plugin developer claims it's not a “valid” vulnerability – you can choose to get it ignored by the plugins.

Ultimately though, it should the Progress Bar developer who would either patch the reported issue or – if they are sure it's a false positive – they should get in touch with the original vulnerability reported (as stated on the vulnerability report page linked above) or Patchstack directly to find a way to get the plugin delisted form there.

Kind regards,
Adams

I don't know if it can help you. I await updates and thank you very much